CVE-2026-80255

highpriority · track · 0EPSS 0.005 · 41 %ileDEFRUS

grimoire priorityP2 · Scheduled

Exploitable?

—

no known exploitation

Likely / severe?

0.48% (41st) EPSS

CVSS 7.5 · high

Is it mine?

9 products

Check your exposure

Who says so?

4 sources

cert_bund · nvd · certfr · osv

EPSS · scored 2026-10-27

A `Set-Cookie:` header using tab (horizontal tab, ASCII code 9) instead of space (ascii code 32) immediately before the `Secure` attribute causes curl to store the cookie without its Secure flag. The cookie might then wrongfully be sent over plaintext HTTP on subsequent requests to the same host.

cvss

Technical severity, 0–10. One row per scoring source.

7.5

010

base score 0–10 · higher = more severe · hover a vector to decode⚠ sources disagree · medium–high · 6.9–7.5

v3.17.5highCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:Nsecondaryexploitability 3.9 · impact 3.6

v3.16.9mediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N/E:Usecondary · CVSS-BT (t0sche)

ssvc

A stakeholder decision — act, attend, or track — from exploitation and impact.

Exploitation: poc · Automatable: yes · Technical Impact: partialcoordinatorcisa_ssvcUS

weaknesses

The CWE weakness classes this flaw belongs to.

CWE-201US

affected products (9)

Products and version ranges known to be affected.

Amazon Linux 2all versionscert_bundDEcpe:/o:amazon:linux_2:-
Fedora Linuxall versionscert_bundDEcpe:/o:fedoraproject:fedora:-
IBM AIX 7.3all versionscert_bundDEcpe:/o:ibm:aix:7.3
Microsoft Azure Linux azl3all versionscert_bundDEcpe:/o:microsoft:azure_linux:azl3
SUSE Linuxall versionscert_bundDEcpe:/o:suse:suse_linux:-
SUSE openSUSEall versionscert_bundDEcpe:/o:suse:opensuse:-
Open Source Open Source cURL <8.22.0< 8.22.0cert_bundDE
Open Source cURL< 8.22.0cert_bundDE
haxx curl8.13.0 → 8.22.0nvdUScpe:2.3:a:haxx:curl:*:*:*:*:*:*:*:*

advisories (4)

Vendor and ecosystem advisories describing this.

WID-SEC-W-2026-3149cURL: Mehrere SchwachstellenDeutsch2026-09-01csaf · cert_bundDE
Ein entfernter Angreifer kann mehrere Schwachstellen in cURL ausnutzen, um Sicherheitsmechanismen zu umgehen, Informationen offenzulegen und einen Denial-of-Service-Zustand herbeizuführen.
WID-SEC-W-2026-3642Meinberg LANTIME: Mehrere SchwachstellenDeutsch2026-09-29csaf · cert_bundDE
Ein Angreifer kann mehrere Schwachstellen in Meinberg LANTIME ausnutzen, um beliebigen Code auszuführen, Sicherheitsmaßnahmen zu umgehen, Daten offenzulegen oder zu manipulieren, Denial-of-Service-Zustände herbeizuführen, sowie weitere, nicht näher spezifizierte Angriffe zu starten.
CERTFR-2026-AVI-1385Multiples vulnérabilités dans les produits VMwareFrançais2026-10-26vendor · certfrFR
CURL-CVE-2026-80255secure cookie attribute bypass with tab2026-09-02vendor · osvUS
A `Set-Cookie:` header using tab (horizontal tab, ASCII code 9) instead of space (ascii code 32) immediately before the `Secure` attribute causes curl to store the cookie without its Secure flag. The cookie might then wrongfully be sent over plaintext HTTP on subsequent requests to the same host.

sources

Which sources assert this record, and when.

cert_bund nvd certfr osv NVD CVE.org MITRE

published 2026-09-06modified 2026-09-15

references (3) nvd

External citations — patches, advisories, analysis.

https://curl.se/docs/CVE-2026-80255.htmlPatchVendor Advisory
https://curl.se/docs/CVE-2026-80255.jsonVendor Advisory
https://hackerone.com/reports/3972395ExploitMitigationThird Party Advisory

scry

Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.

Free scan